Loading story…
The U.S. Federal Trade Commission reached a proposed settlement with data broker Kochava and its subsidiary Collective Data Solutions that would prohibit them from selling, sharing, or disclosing sensitive location data without consumers’ affirmative express consent. The FTC said Kochava sold precise geolocation data tied to hundreds of millions of mobile devices, along with related information such as mobile device IDs, app usage data, and demographic details, in ways that could expose visits to sensitive locations including health care facilities and places of worship.
The proposed order, approved by the FTC in a 2-0 vote and filed in federal court in Idaho, requires Kochava to limit sensitive location data use to consumer-requested services, verify suppliers’ consent practices, notify the FTC about certain improper third-party disclosures, tell consumers who purchased their precise location data, allow consent to be withdrawn, and follow a retention and deletion schedule. The case stems from an FTC lawsuit first filed in 2022, and while the settlement does not impose a fine, it formalizes restrictions that overlap with commitments Kochava had already made in a separate class-action settlement to stop monetizing sensitive location data collected through app SDKs.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
On May 4, 2026, the FTC announced a proposed settlement with Kochava and subsidiary Collective Data Solutions, approved by a 2-0 vote and filed in federal court in Idaho. The order would bar the companies from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent and impose compliance, transparency, and data-deletion requirements.
In November 2025, Kochava agreed in a class-action settlement to stop sharing or selling sensitive location data and to stop monetizing location data collected through app SDKs.
On 2023-11-06, a judge unsealed the FTC's complaint against Kochava, making public allegations about the company's extensive location-data brokerage practices. The unsealing exposed more detail about the FTC's claims regarding the sale of sensitive geolocation information.
In 2023, an FTC complaint further described Kochava's data practices, alleging the company collected and sold information including mobile device IDs, app usage data, income data, and near-real-time location data as unfair and deceptive conduct.
In August 2022, the FTC sued data broker Kochava, alleging it illegally obtained and sold precise geolocation and related data from hundreds of millions of mobile devices in ways that could reveal visits to sensitive locations such as health facilities and places of worship.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcetherecord.media
Open sourceftc.gov
Open sourcetherecord.media
Open sourcetherecord.media
Open sourceftc.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New York has begun enforcing the Algorithmic Pricing Disclosure Act, requiring companies to disclose when they use algorithms and personal data to adjust prices for consumers. This legislation aims to increase transparency around 'surveillance pricing,' where businesses leverage customer data such as location, browsing history, and online behavior to set individualized prices. The Federal Trade Commission (FTC) has also highlighted concerns about these practices, warning that companies could use a wide range of personal data to influence pricing decisions, potentially leading to unfair or discriminatory outcomes for consumers. Separately, the data broker Kochava has agreed to significant changes in its business operations as part of a legal settlement, including ceasing the sale or sharing of sensitive geolocation data and implementing an opt-out mechanism for consumers. The settlement, which awaits final judicial approval, follows FTC allegations that Kochava's sale of precise location data violated rules against unfair and deceptive practices. These developments reflect a broader regulatory push in the United States to address privacy risks and increase accountability for companies that collect, use, and monetize consumer data for pricing and marketing purposes.
Jun 29, 2026
The US Federal Trade Commission reached settlements with Cox Media Group Local Solutions and marketing firms **MindSift LLC** and **1010 Digital Works LLC** over claims that an ad product marketed as **"Active Listening"** or **"Voice Data"** could use AI and microphone data from phones, smart TVs, and other smart devices to target ads based on consumers’ conversations. The companies promoted the service in 2023 and 2024 as if consumers had opted into voice-data collection and as if advertisers could use captured speech to improve localized ad placement, raising concerns that devices were secretly listening to users. The FTC said those claims were false: the service did **not** listen to conversations, did **not** collect voice data, and did **not** deliver the advertised location-based targeting. Instead, Cox Media Group allegedly resold email lists obtained from other data brokers at a markup. Under the settlements, Cox Media Group will pay **$880,000**, while MindSift and 1010 Digital Works will each pay **$25,000**, for a total of **$930,000**; the money is intended to refund affected customers misled by the marketing.
Jun 29, 2026
The **U.S. Federal Trade Commission (FTC)** finalized a **20-year consent order** with **General Motors (GM)** and its subsidiary **OnStar** after alleging the companies collected and sold **precise geolocation** and **driving behavior** data from millions of drivers without valid consent. The FTC said GM’s now-discontinued *Smart Driver* feature was presented as a driving-habits tool while enabling extensive telematics collection (including location and behavior signals such as braking and speed), with data flowing to third parties and ultimately being used by insurers in ways that could affect premiums or coverage decisions. Under the order, GM is **banned for five years** from sharing consumers’ geolocation and driving behavior data with **consumer reporting agencies**. For the full term of the order, GM must obtain **express consent** before collecting, using, or sharing connected-vehicle data (with limited exceptions such as emergency services), and must provide consumer controls including the ability to **opt out/disable precise geolocation collection**, request **copies** of their data, and seek **deletion**. Reporting also notes GM shut down *Smart Driver* in 2024 amid backlash and said it ended related third-party telematics arrangements tied to data brokers such as **LexisNexis** and **Verisk**.
Jun 29, 2026